Skip to content

Commit 2421c2b

Browse files
marns93jaydrogers
marns93
and
jaydrogers
committed
Refactor and improve security headers, file blocks, etc (#631)
* Fix blocking .well-known path for FrankenPHP * Remove specific endpoint checks because the whole folder should be allowed * Enhance security configurations across Apache, NGINX, and Caddy by implementing best practices for HTTP headers and file access restrictions. Added protections against clickjacking, MIME type sniffing, and sensitive file exposure while allowing necessary access to well-known URIs as per RFC 8615. --------- Co-authored-by: Jay Rogers <3174134+jaydrogers@users.noreply.github.com> Co-authored-by: Jay Rogers <jaydrogers@users.noreply.serversideup.net>
1 parent bd0fe9e commit 2421c2b

3 files changed

Lines changed: 120 additions & 100 deletions

File tree

‎src/variations/fpm-apache/etc/apache2/conf-available/security.conf‎

Lines changed: 58 additions & 79 deletions
Original file line numberDiff line numberDiff line change
@@ -1,98 +1,77 @@
1+
##
2+
# Security Configuration
3+
##
4+
5+
# This configuration follows security best practices from:
16
#
2-
# Disable access to the entire file system except for the directories that
3-
# are explicitly allowed later.
7+
# H5BP Server Configs (Apache)
8+
# https://github.com/h5bp/server-configs-apache
49
#
5-
# This currently breaks the configurations that come with some web application
6-
# Debian packages.
10+
# OWASP Secure Headers Project
11+
# https://owasp.org/www-project-secure-headers/
712
#
8-
#<Directory />
9-
# AllowOverride None
10-
# Require all denied
11-
#</Directory>
12-
13+
# RFC 8615 - Well-Known URIs
14+
# https://www.rfc-editor.org/rfc/rfc8615
15+
#
16+
# ##############################################################################
1317

14-
# Changing the following options will not really affect the security of the
15-
# server, but might make attacks slightly more difficult in some cases.
18+
# ------------------------------------------------------------------------------
19+
# | Server Software Information |
20+
# ------------------------------------------------------------------------------
1621

17-
#
18-
# ServerTokens
19-
# This directive configures what you return as the Server HTTP response
20-
# Header. The default is 'Full' which sends information about the OS-Type
21-
# and compiled in modules.
22-
# Set to one of: Full | OS | Minimal | Minor | Major | Prod
23-
# where Full conveys the most information, and Prod the least.
24-
#ServerTokens Minimal
25-
# ServerTokens OS
26-
# #ServerTokens Full
22+
# Minimize information sent about the server
23+
# https://httpd.apache.org/docs/current/mod/core.html#servertokens
2724
ServerTokens Prod
2825

29-
#
30-
# Optionally add a line containing the server version and virtual host
31-
# name to server-generated pages (internal error documents, FTP directory
32-
# listings, mod_status and mod_info output etc., but not CGI generated
33-
# documents or custom error documents).
34-
# Set to "EMail" to also include a mailto: link to the ServerAdmin.
35-
# Set to one of: On | Off | EMail
26+
# Disable server signature on error pages
27+
# https://httpd.apache.org/docs/current/mod/core.html#serversignature
3628
ServerSignature Off
37-
# ServerSignature On
3829

39-
#
40-
# Allow TRACE method
41-
#
42-
# Set to "extended" to also reflect the request body (only for testing and
43-
# diagnostic purposes).
44-
#
45-
# Set to one of: On | Off | extended
30+
# Disable TRACE HTTP method to prevent XST attacks
31+
# https://owasp.org/www-community/attacks/Cross_Site_Tracing
4632
TraceEnable Off
47-
#TraceEnable On
4833

49-
#
50-
# Forbid access to version control directories
51-
#
52-
# If you use version control systems in your document root, you should
53-
# probably deny access to their directories. For example, for subversion:
54-
#
55-
<DirectoryMatch "/\.git">
56-
Require all denied
34+
# ------------------------------------------------------------------------------
35+
# | Security Headers |
36+
# ------------------------------------------------------------------------------
37+
38+
# Prevent clickjacking attacks by disabling iframe embedding
39+
# https://owasp.org/www-project-secure-headers/#x-frame-options
40+
Header always set X-Frame-Options "SAMEORIGIN"
41+
42+
# Prevent MIME type sniffing attacks
43+
# https://owasp.org/www-project-secure-headers/#x-content-type-options
44+
Header always set X-Content-Type-Options "nosniff"
45+
46+
# Control referrer information sent with requests
47+
# https://owasp.org/www-project-secure-headers/#referrer-policy
48+
Header always set Referrer-Policy "strict-origin-when-cross-origin"
49+
50+
# Enable HTTP Strict Transport Security (HSTS)
51+
# https://owasp.org/www-project-secure-headers/#strict-transport-security
52+
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
53+
54+
# ------------------------------------------------------------------------------
55+
# | File Access Restrictions |
56+
# ------------------------------------------------------------------------------
57+
58+
# Block access to all hidden files and directories (dotfiles)
59+
# EXCEPT for the "/.well-known/" directory which is required by RFC 8615
60+
# for ACME challenges, security.txt, and other standardized endpoints.
61+
# https://www.rfc-editor.org/rfc/rfc8615
62+
# https://github.com/h5bp/server-configs-apache
63+
<DirectoryMatch "/\.(?!well-known/)">
64+
Require all denied
5765
</DirectoryMatch>
5866

59-
# Prevent Apache from serving Gitlab files
60-
<FilesMatch "\.gitlab-ci.yml$">
61-
Require all denied
67+
# Block access to files that may expose sensitive information
68+
# Based on H5BP server configs: https://github.com/h5bp/server-configs-apache
69+
<FilesMatch "(^#.*#|\.(bak|conf|config|dist|inc|ini|log|sh|sql|sw[op])|~)$">
70+
Require all denied
6271
</FilesMatch>
6372

6473
# Disable XML-RPC on all wordpress sites
6574
<Files xmlrpc.php>
6675
Require all denied
6776
# allow from xxx.xxx.xxx.xxx
68-
</Files>
69-
70-
#
71-
# Setting this header will prevent MSIE from interpreting files as something
72-
# else than declared by the content type in the HTTP headers.
73-
# Requires mod_headers to be enabled.
74-
#
75-
Header always set X-Content-Type-Options: "nosniff"
76-
77-
#
78-
# Setting this header will prevent other sites from embedding pages from this
79-
# site as frames. This defends against clickjacking attacks.
80-
# Requires mod_headers to be enabled.
81-
#
82-
Header always set X-Frame-Options: "sameorigin"
83-
84-
#
85-
# Referrer policy
86-
#
87-
Header always set Referrer-Policy "no-referrer-when-downgrade"
88-
89-
#
90-
# Content Security Policy
91-
# UPDATE - September 2020: Commenting this out until we grasp better security requirements
92-
#
93-
#Header always set Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'"
94-
95-
#
96-
# Strict-Transport-Security Policy (set HSTS)
97-
#
98-
Header always set Strict-Transport-Security "max-age=15552000; includeSubDomains"
77+
</Files>

‎src/variations/fpm-nginx/etc/nginx/server-opts.d/security.conf‎

Lines changed: 38 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,51 @@
1+
##
2+
# Security Configuration
3+
##
4+
5+
# This configuration follows security best practices from:
6+
#
7+
# H5BP Server Configs (nginx)
8+
# https://github.com/h5bp/server-configs-nginx
19
#
2-
# Security Headers
10+
# OWASP Secure Headers Project
11+
# https://owasp.org/www-project-secure-headers/
312
#
13+
# RFC 8615 - Well-Known URIs
14+
# https://www.rfc-editor.org/rfc/rfc8615
15+
#
16+
# ##############################################################################
417

5-
# Prevent IFRAME spoofing attacks
18+
# Prevent clickjacking attacks by disabling iframe embedding
19+
# https://owasp.org/www-project-secure-headers/#x-frame-options
620
add_header X-Frame-Options "SAMEORIGIN" always;
721

8-
# Prevent MIME attacks
22+
# Prevent MIME type sniffing attacks
23+
# https://owasp.org/www-project-secure-headers/#x-content-type-options
924
add_header X-Content-Type-Options "nosniff" always;
1025

11-
# Prevent Referrer URL from being leaked
12-
add_header Referrer-Policy "no-referrer-when-downgrade" always;
13-
14-
# Configure Content Security Policy
15-
# UPDATE - September 2020: Commenting this out until we grasp better security requirements
16-
#add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
26+
# Control referrer information sent with requests
27+
# https://owasp.org/www-project-secure-headers/#referrer-policy
28+
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
1729

18-
# Enable HSTS
30+
# Enable HTTP Strict Transport Security (HSTS)
31+
# https://owasp.org/www-project-secure-headers/#strict-transport-security
1932
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
2033

21-
# Prevent access to . files (the well-known directory)
34+
# ------------------------------------------------------------------------------
35+
# | File Access Restrictions |
36+
# ------------------------------------------------------------------------------
37+
38+
# Block access to hidden files and directories (dotfiles)
39+
# EXCEPT for the "/.well-known/" directory which is required by RFC 8615
40+
# for ACME challenges, security.txt, and other standardized endpoints.
41+
# https://www.rfc-editor.org/rfc/rfc8615
42+
# https://github.com/h5bp/server-configs-nginx
2243
location ~ /\.(?!well-known) {
2344
deny all;
45+
}
46+
47+
# Block access to files that may expose sensitive information
48+
# Based on H5BP server configs: https://github.com/h5bp/server-configs-nginx
49+
location ~* (?:#.*#|\.(?:bak|conf|config|dist|inc|ini|log|sh|sql|sw[op])|~)$ {
50+
deny all;
2451
}

‎src/variations/frankenphp/etc/frankenphp/Caddyfile‎

Lines changed: 24 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -127,24 +127,38 @@ fd00::/8 \
127127
}
128128

129129
(security) {
130-
# Reject dot files and certain file extensions
131-
@rejected path *.bak *.conf *.dist *.fla *.ini *.inc *.inci *.log *.orig *.psd *.sh *.sql *.swo *.swp *.swop */.*
132-
133-
# Return 403 Forbidden for rejected files
130+
# This configuration follows security best practices from:
131+
#
132+
# H5BP Server Configs (nginx) - Adapted for Caddy
133+
# https://github.com/h5bp/server-configs-nginx
134+
#
135+
# OWASP Secure Headers Project
136+
# https://owasp.org/www-project-secure-headers/
137+
#
138+
# RFC 8615 - Well-Known URIs
139+
# https://www.rfc-editor.org/rfc/rfc8615
140+
141+
# Block access to files that may expose sensitive information
142+
@rejected {
143+
path *.bak *.conf *.config *.dist *.inc *.ini *.log *.sh *.sql *.swp *.swo *~ */.*
144+
# EXCEPTION: /.well-known/* is allowed per RFC 8615 for ACME challenges
145+
# https://www.rfc-editor.org/rfc/rfc8615
146+
not path /.well-known/*
147+
}
134148
respond @rejected 403
135149

136-
# Security headers
150+
# Security Headers
151+
# https://owasp.org/www-project-secure-headers/
137152
header {
138153
defer
139-
# Prevent IFRAME spoofing attacks
154+
# Prevent clickjacking attacks by disabling iframe embedding
140155
X-Frame-Options "SAMEORIGIN"
141-
# Prevent MIME type sniffing
156+
# Prevent MIME type sniffing attacks
142157
X-Content-Type-Options "nosniff"
143-
# Prevent referrer leakage
158+
# Control referrer information sent with requests
144159
Referrer-Policy "strict-origin-when-cross-origin"
145-
# Prevent server header leakage
160+
# Remove server identification headers
146161
-Server
147-
# Prevent powered by header leakage
148162
-X-Powered-By
149163
}
150164
}

0 commit comments

Comments
 (0)